summaryrefslogtreecommitdiffstats
path: root/ospfd
diff options
context:
space:
mode:
authorRenato Westphal <renato@opensourcerouting.org>2021-05-31 15:27:51 +0200
committerRenato Westphal <renato@opensourcerouting.org>2021-06-08 16:41:33 +0200
commitb4a970999cd9c85ebc617b130b6043ac7e9226c3 (patch)
tree4fc4e075f403536e5afaf6dc88412cfee3466a6d /ospfd
parentospfd: fix dangling pointer when exiting from the helper mode (diff)
downloadfrr-b4a970999cd9c85ebc617b130b6043ac7e9226c3.tar.xz
frr-b4a970999cd9c85ebc617b130b6043ac7e9226c3.zip
ospfd: fix null pointer dereference when flushing an opaque LSA
Call ospf_lsa_flush() before free_opaque_info_per_id() since the latter can deallocate the LSA that is going to be flushed. Also, there's no need to set the LSA MaxAge to OSPF_LSA_MAXAGE manually as the ospf_lsa_flush() function already takes care of that. Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
Diffstat (limited to 'ospfd')
-rw-r--r--ospfd/ospf_opaque.c13
1 files changed, 5 insertions, 8 deletions
diff --git a/ospfd/ospf_opaque.c b/ospfd/ospf_opaque.c
index 42bf914f6..fac2f9714 100644
--- a/ospfd/ospf_opaque.c
+++ b/ospfd/ospf_opaque.c
@@ -2119,15 +2119,12 @@ void ospf_opaque_lsa_flush_schedule(struct ospf_lsa *lsa0)
goto out;
}
+ /* This lsa will be flushed and removed eventually. */
+ ospf_lsa_flush(top, lsa);
+
/* Dequeue listnode entry from the list. */
listnode_delete(oipt->id_list, oipi);
- /* Disassociate internal control information with the given lsa. */
- free_opaque_info_per_id((void *)oipi);
-
- /* Force given lsa's age to MaxAge. */
- lsa->data->ls_age = htons(OSPF_LSA_MAXAGE);
-
if (IS_DEBUG_OSPF_EVENT)
zlog_debug(
"Schedule Type-%u Opaque-LSA to FLUSH: [opaque-type=%u, opaque-id=%x]",
@@ -2135,8 +2132,8 @@ void ospf_opaque_lsa_flush_schedule(struct ospf_lsa *lsa0)
GET_OPAQUE_TYPE(ntohl(lsa->data->id.s_addr)),
GET_OPAQUE_ID(ntohl(lsa->data->id.s_addr)));
- /* This lsa will be flushed and removed eventually. */
- ospf_lsa_flush(top, lsa);
+ /* Disassociate internal control information with the given lsa. */
+ free_opaque_info_per_id((void *)oipi);
out:
return;